CVE-2007-2897: Undefined Security Weakness

Microsoft Internet Information Services IIS 6.0 allows remote attackers to cause a denial of service server instability or device hang, and possibly obtain sensitive information device communication traffic; and might allow attackers with physical access to execute arbitrary code after connecting...

[Full-disclosure] Question Regarding IIS 6.0 / Is this a DoS???

Hello List, Recently I saw a small bug in IIS 6.0 when requesting a special path. When I request /AUX/.aspx the server takes a bit longer to respond as Normally. So I did write an automated script to see what happens if I request this file several times at once. The result is that some servers On...

Microsoft IIS 6.0 - AUX .aspx Remote Denial of Service

Microsoft IIS 6.0 - AUX .aspx Remote Denial of Service When sending multiple parallel GET requests to a IIS 6.0 server requesting /AUX/.aspx the server gets instable and non responsive. This happens only to servers which respond a runtime error System.Web.HttpException and take two or more second...

Microsoft IIS 6.0 - '/AUX / '.aspx' Remote Denial of Service

When sending multiple parallel GET requests to a IIS 6.0 server requesting /AUX/.aspx the server gets instable and non responsive. This happens only to servers which respond a runtime error System.Web.HttpException and take two or more seconds to respond to the /AUX/.aspx GET request. signed,...

CVE-2007-0302

Multiple cross-site scripting XSS vulnerabilities in InstantASP 4.1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 SessionID parameter to a Logon.aspx, and the 2 Username and 3 Update parameters to b Members1.aspx...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in InstantASP 4.1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 SessionID parameter to a Logon.aspx, and the 2 Username and 3 Update parameters to b Members1.aspx...

CVE-2007-0302

Multiple cross-site scripting XSS vulnerabilities in InstantASP 4.1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 SessionID parameter to a Logon.aspx, and the 2 Username and 3 Update parameters to b Members1.aspx...

CVE-2007-0302

CVE-2007-0302 affects InstantASP 4.1.0 with multiple cross-site scripting (XSS) flaws. An attacker can inject arbitrary script/HTML via (1) SessionID to Logon.aspx and (2) Username and (3) Update to Members1.aspx, enabling web-script injection. The NVD CVSS2 base score is 6.8 (MEDIUM) with networ...

CVE-2007-0302: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in InstantASP 4.1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 SessionID parameter to a Logon.aspx, and the 2 Username and 3 Update parameters to b Members1.aspx...

InstantASP 4.1 - 'Members1.aspx' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/22052/info InstantForum.NET is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit these issues to steal cookie-based authentication credentials and...

XSS in InstantForum.NET v4.1.1

Advisory: InstantForum.NET v4.1.1 Home Page: http://instantasp.co.uk/ Уязвимость/Vulnerability: Межсайтовый скриптинг/Cross Site Scripting Уязвимый скрипт/Vulnerable script: Logon.aspx, Search1-2-1.aspx, InsertAttachments.aspx...

CVE-2006-0704

iE Integrator 4.4.220114, when configured without a "bespoke error page" in acm.ini, allows remote attackers to obtain sensitive information via a URL that calls a non-existent .aspx script in the integrator/apps directory, which results in an error message that displays the installation path, we...

CVE-2006-0704: Undefined Security Weakness

iE Integrator 4.4.220114, when configured without a "bespoke error page" in acm.ini, allows remote attackers to obtain sensitive information via a URL that calls a non-existent .aspx script in the integrator/apps directory, which results in an error message that displays the installation path, we...

CVE-2005-4497: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Tangora Portal CMS 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the action parameter in a search page, as demonstrated using 1 page1631.aspx and 2 page496.aspx...

CVE-2005-3287

Incomplete blacklist vulnerability in Mailsite Express allows remote attackers to upload and possibly execute files via attachments with executable extensions such as ASPX, which are not converted to .TXT like other dangerous extensions, and which can be directly requested from the cache director...

VulnCheck KEV: CVE-2004-0847

The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a 1 "" backslash or 2 "%5C" encoded backslash, aka "Path Validation Vulnerability."...